WhoisFreaks is a domain and IP intelligence API that provides live and historical WHOIS data, DNS records, SSL certificates, and subdomain discovery for cybersecurity, brand protection, and domain research — accessed through REST APIs and downloadable databases.
What is WhoisFreaks?
WhoisFreaks is a data platform that accepts domain names, IP addresses, or hostnames as input and returns parsed, normalized WHOIS records, DNS resolution data, SSL certificate chains, subdomain lists, and IP reputation/geolocation information. It runs as a cloud-based API service with batch endpoints and is developed by the WhoisFreaks team (no parent company stated on the page). The platform supports over 1,524 TLDs and offers historical WHOIS records dating back to 1986, making it a go-to source for longitudinal domain research.
Key Features
- Live WHOIS API — Returns structured JSON with registrar, registrant, name servers, domain status, and raw whois output for any domain; covers 1,524+ TLDs with daily updated records.
- Historical WHOIS Database — Provides snapshots of WHOIS data going back to 1986, enabling change tracking and audit trails. Available via API and as bulk downloadable datasets.
- DNS & Subdomain Intelligence — Delivers A, AAAA, MX, NS, SOA, TXT, SPF, PTR, and CNAME records alongside a subdomain discovery engine tracking 5B+ hostnames and 14B+ DNS records.
- SSL Certificate Lookup — Returns end-user, intermediate, and root certificate details including validity periods, issuer, subject, key algorithm, and SANs for any domain.
- IP Reputation & Geolocation — Enables querying IP addresses for threat scoring, geolocation data (country, city, ASN), and reverse DNS lookups.
- Bulk Data Downloads — Offers pre-built datasets (e.g., domains by registrant, country, or TLD) in developer-friendly formats such as JSON, CSV, and SQL dumps.
- REST API & SDKs — Supports JSON responses, batch requests, and integration with common languages (JavaScript, Node.js, Python, etc.) via documented endpoints.
Who is it for?
- Cybersecurity researchers — Use the WHOIS historical API to investigate domain reputation changes, track infrastructure pivots, and identify malicious registrations.
- Domain investors — Bulk query WHOIS status, expiry dates, and registrant data across thousands of domains to identify expiring or undervalued assets.
- Brand protection teams — Monitor domain registrations that mirror your brand using subdomain discovery and WHOIS alerts, then take action against phishing or typosquatting.
What can you do with WhoisFreaks?
- Enrich SIEM/SOAR pipelines — Integrate live WHOIS, DNS, and IP reputation data into security workflows to validate domain indicators and automate incident enrichment.
- Backlink and competitor analysis — Use subdomain and DNS history to map a competitor’s infrastructure changes, new services, and hosting migrations over time.
- Domain portfolio management — Automate mass WHOIS lookups for thousands of domains to track renewal dates, registrar changes, and ownership shifts using the bulk API.
- Threat hunting — Cross-reference historical WHOIS records with threat intelligence feeds to find domains that were registered shortly before an attack and later altered their contact details.
How does WhoisFreaks work?
- Sign up for a freemium account at the billing portal to receive an API key.
- Query via REST endpoints (e.g.,
/whois/v1, /dns/v1, /subdomains/v1) by passing a domain or IP as a query parameter.
- Receive structured JSON responses, or download entire datasets for offline analysis. Daily updates ensure data freshness, and deduplication removes stale records.
